[Serverless] Manual rule run docs (#5589)

* First draft * Second draft * Fix ref and add tech preview tag * Minor rewording * Fix incorrect ref * Adding API docs * Update docs/detections/api/rules/rules-api-bulk-actions.asciidoc Co-authored-by: Ievgen Sorokopud <[email protected]> * Zhenia's input * Re-adding line accidentally deleted * Removed uncessary header * Moved section to correct spot * Updating images * Minor wording adjustments * Fixed formatting and editorial typos * Update docs/detections/rules-ui-manage.asciidoc * Applying feedback to Serverless docs * Update docs/detections/rules-ui-manage.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/rules-ui-management.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/detections/rules-ui-manage.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/rules-ui-management.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/detections/rules-ui-monitor.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/detections/rules-ui-monitor.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/detections/rules-ui-monitor.asciidoc * Update docs/serverless/rules/alerts-ui-monitor.mdx * Update docs/detections/rules-ui-monitor.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx * Update docs/detections/rules-ui-manage.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Joe's input * Update docs/detections/rules-ui-monitor.asciidoc * Input from editorial and technical reviews * Update docs/detections/rules-ui-manage.asciidoc * Update docs/serverless/rules/rules-ui-management.mdx * Removing ESS changes * Removing more ESS API changes * Cleaning up last ESS changes * Readding ref * Limitations and alert field * Switch sentence order * Updates note * Update docs/serverless/rules/rules-ui-management.mdx * Update docs/serverless/rules/alerts-ui-monitor.mdx * Update docs/serverless/rules/alerts-ui-monitor.mdx * Update docs/serverless/alerts/alert-schema.mdx Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/serverless/rules/rules-ui-management.mdx Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Nastasha Solomon <[email protected]> * Update docs/serverless/rules/rules-ui-management.mdx Co-authored-by: Nastasha Solomon <[email protected]> * Minor wording tweak * Removed incorrect path * Used EUI icon * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Benjamin Ironside Goldstein <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/rules-ui-management.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/rules-ui-management.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/rules-ui-management.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/alerts-ui-monitor.mdx Co-authored-by: Joe Peeples <[email protected]> * Joe's input * Adds beta tag --------- Co-authored-by: Ievgen Sorokopud <[email protected]> Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: Kseniia Ignatovych <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
elastic · Oct 16, 2024 · 4cbfd6d · 4cbfd6d
1 parent 61b4a66
commit 4cbfd6d
Show file tree

Hide file tree

Showing 5 changed files with 80 additions and 3 deletions.
diff --git a/docs/serverless/alerts/alert-schema.mdx b/docs/serverless/alerts/alert-schema.mdx
@@ -904,4 +904,17 @@ The non-ECS fields listed below are beta and subject to change.
 
     </DocCell>
   </DocRow>
+    <DocRow>
+    <DocCell> `kibana.alert.intended_timestamp`</DocCell>
+    <DocCell>
+      Shows the alert’s estimated timestamp, had the alert been created when the source event initially occurred. The value in this field is determined by the way the rule was run:
+
+         * **Scheduled run**: Alerts created by scheduled runs have the same timestamp as the `kibana.alert.rule.execution.timestamp` field, which shows when the rule was executed.
+         * **Manual run**: Alerts created by manual runs have a timestamp that falls within the time range specified for the manual run. For example, if you set a rule to manually run on event data from `10/01/2024 05:00 PM` to `10/07/2024 05:00 PM`, the `kibana.alert.intended_timestamp` value will be a date and time within that range.
+
+
+      Type: date
+
+    </DocCell>
+  </DocRow>
 </DocTable>
diff --git a/docs/serverless/images/alerts-ui-monitor/-detections-manual-rule-run-table.png b/docs/serverless/images/alerts-ui-monitor/-detections-manual-rule-run-table.png
diff --git a/docs/serverless/images/alerts-ui-monitor/-detections-rule-execution-logs.png b/docs/serverless/images/alerts-ui-monitor/-detections-rule-execution-logs.png
diff --git a/docs/serverless/rules/alerts-ui-monitor.mdx b/docs/serverless/rules/alerts-ui-monitor.mdx
@@ -41,27 +41,60 @@ For detailed information on a rule, the alerts it generated, and associated erro
 
 ## Execution results
 
-Each detection rule execution is logged, including its success or failure, any warning or error messages, and how long it took to search for data, create alerts, and complete. This can help you troubleshoot a particular rule if it isn't behaving as expected (for example, if it isn't creating alerts or takes a long time to run).
+Each detection rule execution is logged, including the execution type, the execution's success or failure, any warning or error messages, how long it took to search for data, create alerts, and complete. This can help you troubleshoot a particular rule if it isn't behaving as expected (for example, if it isn't creating alerts or takes a long time to run).
 
-To access a rule's execution log, go to **Rules** → **Detection rules (SIEM)**, click the rule's name to open its details, then scroll down and select the **Execution results** tab. You can expand a long warning or error message by clicking the arrow at the end of a row.
+To access a rule's execution log, go to **Rules** → **Detection rules (SIEM)**, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Within the Execution log table, you can click the arrow at the end of a row to expand a long warning or error message.
 
-![Rule execution results tab](../images/alerts-ui-monitor/-detections-rule-execution-logs.png)
+![Rule execution log on the rule execution results tab](../images/alerts-ui-monitor/-detections-rule-execution-logs.png)
 
 You can hover over each column heading to display a tooltip about that column's data. Click a column heading to sort the table by that column.
 
 Use these controls to filter what's included in the logs table:
 
+* The **Run type** drop-down filters the table by rule execution type: 
+    * **Scheduled**: Automatic, scheduled rule executions.
+    * **Manual**: Rule executions that were <DocLink slug="/serverless/security/rules-ui-management" section="manually-run-rules">started manually</DocLink>.
+
 * The **Status** drop-down filters the table by rule execution status: 
     * **Succeeded**: The rule completed its defined search. This doesn't necessarily mean it generated an alert, just that it ran without error.
     * **Failed**: The rule encountered an error that prevented it from running. For example, a ((ml)) rule whose corresponding ((ml)) job wasn't running.
     * **Warning**: Nothing prevented the rule from running, but it might have returned unexpected results. For example, a custom query rule tried to search an index pattern that couldn't be found in ((es)).
 
 * The date and time picker sets the time range of rule executions included in the table. This is separate from the global date and time picker at the top of the rule details page.
 
+* The **Source event time range** button toggles the display of data pertaining to the time range of manual runs.
+
 * The **Show metrics columns** toggle includes more or less data in the table, pertaining to the timing of each rule execution.
 
 * The **Actions** column allows you to show alerts generated from a given rule execution. Click the filter icon (<DocIcon type="filterInCircle" title="Filter" size="s"/>) to create a global search filter based on the rule execution's ID value. This replaces any previously applied filters, changes the global date and time range to 24 hours before and after the rule execution, and displays a confirmation notification. You can revert this action by clicking **Restore previous filters** in the notification.
 
+<div id="manual-runs-table"></div>
+
+### Manual runs table
+
+<DocBadge template="beta" /> 
+
+Each manual run can produce multiple rule executions, depending on the time range of the run and the rule's execution schedule. These details are shown in the Manual runs table.
+
+To access the Manual runs table, navigate to the detection rules page, click the rule's name to open its details, then scroll down and select the **Execution results** tab. Scroll down again to find the Manual runs table. 
+
+To stop an active run, go to the appropriate row and click **Stop run** in the **Actions** column. Completed rule executions for each manual run are logged in the Execution log table.
+
+![Manual rule runs table on the rule execution results tab](../images/alerts-ui-monitor/-detections-manual-rule-run-table.png)
+
+The Manual runs table displays important details such as:
+
+* The status of each manual run:
+   * **Pending**: The rule is not yet running. 
+   *  **Running**: The rule is executing during the time range you specified. Some rules, such as indicator match rules, can take longer to run.
+   * **Error**: The rule's configuration is preventing it from running correctly. For example, the rule's conditions cannot be validated. 
+
+* When a manual run started and the time in which it will run
+
+* The number of rule executions that are failing, pending, running, and completed for a manual run
+
+* The total number of rule executions that are occurring for a manual run
+
 <div id="troubleshoot-signals"></div>
 
 ## Troubleshoot missing alerts

diff --git a/docs/serverless/rules/rules-ui-management.mdx b/docs/serverless/rules/rules-ui-management.mdx
@@ -19,6 +19,7 @@ On the Rules page, you can:
 * <DocLink slug="/serverless/security/rules-ui-management" section="check-the-current-status-of-rules">Check the current status of rules</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="modify-existing-rules-settings">Modify existing rules settings</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="manage-rules">Manage rules</DocLink>
+* <DocLink slug="/serverless/security/rules-ui-management" section="manually-run-rules">Manually run rules</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="snooze-rule-actions">Snooze rule actions</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="export-and-import-rules">Export and import rules</DocLink>
 * <DocLink slug="/serverless/security/rules-ui-management" section="confirm-rule-prerequisites">Confirm rule prerequisites</DocLink>
@@ -111,6 +112,36 @@ When duplicating a rule with exceptions, you can choose to duplicate the rule an
     * To enable or disable a single rule, switch on the rule's **Enabled** toggle.
     * To <DocLink slug="/serverless/security/rules-ui-management" section="snooze-rule-actions">snooze</DocLink> actions for rules, click the bell icon.
 
+<div id="manually-run-rules"></div>
+
+## Run rules manually
+
+<DocBadge template="beta" />
+
+Manually run enabled rules for a specfied period of time for testing purposes or additional rule coverage.
+
+<DocCallOut title="Important" color="warning">
+Before manually running rules, make sure you properly understand and plan for rule dependencies. Incorrect scheduling can lead to inconsistent rule results.
+</DocCallOut>
+
+1. Navigate to the detection rules page, and do one of the following:
+    * Select the **All actions** menu (<DocIcon type="boxesHorizontal" title="Actions menu" size="m" />) on a rule, then select **Manual run**.
+    * Select all the rules you want to manually run, select the **Bulk actions** menu, then select **Manual run**.
+1. Specify when the manual run starts and ends. The default selection is the current day starting three hours in the past. The rule will search for events during the selected time range.
+1. Click **Run** to manually run the rule.
+   <DocCallOut title="Note">
+   Manual runs can produce multiple rule executions. This is determined by the manual run's time range and the rule's execution schedule.
+   </DocCallOut>
+
+The manual run's details are shown in the <DocLink slug="/serverless/security/alerts-ui-monitor" section="manual-runs-table">Manual runs</DocLink> table on the **Execution results** tab. Changes you make to the manual run or rule settings will display in the Manual runs table after the current run completes.
+
+<DocCallOut title="Note">
+Be mindful of the following:
+* Rule actions are not activated during manual runs. 
+* Except for threshold rules, duplicate alerts aren't created if you manually run a rule during a time range that was already covered by a scheduled run.
+* Manual runs are executed with low priority and limited concurrency, meaning they might take longer to complete. This can be especially apparent for rules requiring multiple executions.
+</DocCallOut>
+
 <div id="snooze-rule-actions"></div>
 
 ## Snooze rule actions